# Sfoffo - Pentesting Notes ## Sfoffo - Pentesting Notes - [/home/sfoffo/.pt-notes](https://notes.sfoffo.com/readme.md) - [Active Directory](https://notes.sfoffo.com/active-directory.md) - [Initial Access](https://notes.sfoffo.com/active-directory/initial-access.md) - [Internal Enumeration & Lateral Movement](https://notes.sfoffo.com/active-directory/internal-enumeration-and-lateral-movement.md) - [Privilege Escalation to Domain Admin using Known Exploits](https://notes.sfoffo.com/active-directory/privilege-escalation-to-domain-admin-using-known-exploits.md) - [Domain Trusts](https://notes.sfoffo.com/active-directory/domain-trusts.md) - [Linux Privilege Escalation](https://notes.sfoffo.com/linux-privilege-escalation.md) - [Enumerating Attack Vectors](https://notes.sfoffo.com/linux-privilege-escalation/enumerating-attack-vectors.md) - [Privileged Groups](https://notes.sfoffo.com/linux-privilege-escalation/privileged-groups.md) - [Environment Variables Abuse](https://notes.sfoffo.com/linux-privilege-escalation/environment-variables-abuse.md) - [Capabilities Abuse](https://notes.sfoffo.com/linux-privilege-escalation/capabilities-abuse.md) - [Programs, Jobs and Services](https://notes.sfoffo.com/linux-privilege-escalation/programs-jobs-and-services.md) - [Miscellaneous Techniques](https://notes.sfoffo.com/linux-privilege-escalation/miscellaneous-techniques.md) - [Windows Privilege Escalation](https://notes.sfoffo.com/windows-privilege-escalation.md) - [Enumerating Attack Vectors](https://notes.sfoffo.com/windows-privilege-escalation/enumerating-attack-vectors.md) - [Excessive User Rights Abuse](https://notes.sfoffo.com/windows-privilege-escalation/excessive-user-rights-abuse.md) - [Built-in Groups Abuse](https://notes.sfoffo.com/windows-privilege-escalation/built-in-groups-abuse.md) - [File System ACLs](https://notes.sfoffo.com/windows-privilege-escalation/file-system-acls.md) - [Services Hijacking](https://notes.sfoffo.com/windows-privilege-escalation/unquoted-service-paths.md) - [User Account Control (UAC) Bypass](https://notes.sfoffo.com/windows-privilege-escalation/user-account-control-uac-bypass.md) - [Living off the Land](https://notes.sfoffo.com/windows-privilege-escalation/living-off-the-land.md) - [Bug Bounty Hunting](https://notes.sfoffo.com/bug-bounty-hunting.md) - [Bug Bounty Tools](https://notes.sfoffo.com/bug-bounty-hunting/bug-bounty-tools.md) - [Web Applications](https://notes.sfoffo.com/web-applications.md) - [Web Attacks](https://notes.sfoffo.com/web-applications/web-attacks.md) - [Cross Site Scripting (XSS)](https://notes.sfoffo.com/web-applications/web-attacks/cross-site-scripting-xss.md) - [CSRF](https://notes.sfoffo.com/web-applications/web-attacks/csrf.md) - [File Upload Vulnerabilities](https://notes.sfoffo.com/web-applications/web-attacks/file-uploads.md) - [NoSQL Injection](https://notes.sfoffo.com/web-applications/web-attacks/nosql-injection.md) - [JSON Web Tokens (JWTs)](https://notes.sfoffo.com/web-applications/web-attacks/json-web-tokens-jwts.md) - [SQL Injection (SQLi)](https://notes.sfoffo.com/web-applications/web-attacks/sql-injection.md) - [SSRF](https://notes.sfoffo.com/web-applications/web-attacks/ssrf.md) - [OAuth Attacks](https://notes.sfoffo.com/web-applications/web-attacks/oauth-attacks.md) - [SAML Attacks](https://notes.sfoffo.com/web-applications/web-attacks/saml-attacks.md) - [Insecure Direct Object References (IDOR)](https://notes.sfoffo.com/web-applications/web-attacks/insecure-direct-object-references-idor.md) - [OS Command Injection](https://notes.sfoffo.com/web-applications/web-attacks/os-command-injection.md) - [Web Cache Poisoning](https://notes.sfoffo.com/web-applications/web-attacks/web-cache-poisoning.md) - [Local File Inclusion (LFI)](https://notes.sfoffo.com/web-applications/web-attacks/local-file-inclusion-lfi.md) - [Remote File Inclusion (RFI)](https://notes.sfoffo.com/web-applications/web-attacks/remote-file-inclusion-rfi.md) - [XML External Entities (XXE)](https://notes.sfoffo.com/web-applications/web-attacks/xml-external-entities-xxe.md) - [XPath Injection](https://notes.sfoffo.com/web-applications/web-attacks/xpath-injection.md) - [LDAP Injection](https://notes.sfoffo.com/web-applications/web-attacks/ldap-injection.md) - [HTTP Verb Tampering](https://notes.sfoffo.com/web-applications/web-attacks/http-verb-tampering.md) - [Web Technologies](https://notes.sfoffo.com/web-applications/web-technologies.md) - [Tomcat](https://notes.sfoffo.com/web-applications/web-technologies/tomcat.md) - [CGI Applications](https://notes.sfoffo.com/web-applications/web-technologies/cgi-applications.md) - [WordPress](https://notes.sfoffo.com/web-applications/web-technologies/wordpress.md) - [PDF Generators](https://notes.sfoffo.com/web-applications/web-technologies/pdf-generators.md) - [Microsoft IIS](https://notes.sfoffo.com/web-applications/web-technologies/microsoft-iis.md) - [WebDav](https://notes.sfoffo.com/web-applications/web-technologies/webdav.md) - [IBM WebSphere](https://notes.sfoffo.com/web-applications/web-technologies/ibm-websphere.md) - [SAP Netweaver](https://notes.sfoffo.com/web-applications/web-technologies/sap-netweaver.md) - [Joomla](https://notes.sfoffo.com/web-applications/web-technologies/joomla.md) - [Drupal](https://notes.sfoffo.com/web-applications/web-technologies/drupal.md) - [Gitlab](https://notes.sfoffo.com/web-applications/web-technologies/gitlab.md) - [Jenkins](https://notes.sfoffo.com/web-applications/web-technologies/jenkins.md) - [Fuzzing](https://notes.sfoffo.com/web-applications/fuzzing.md) - [Information Gathering](https://notes.sfoffo.com/information-gathering.md) - [Protocols and Services](https://notes.sfoffo.com/protocols-and-services.md) - [DNS](https://notes.sfoffo.com/protocols-and-services/dns.md) - [FTP](https://notes.sfoffo.com/protocols-and-services/ftp.md) - [IMAP](https://notes.sfoffo.com/protocols-and-services/imap.md) - [IPMI](https://notes.sfoffo.com/protocols-and-services/ipmi.md) - [MSSQL](https://notes.sfoffo.com/protocols-and-services/mssql.md) - [MySQL](https://notes.sfoffo.com/protocols-and-services/mysql.md) - [NFS](https://notes.sfoffo.com/protocols-and-services/nfs.md) - [Oracle TNS](https://notes.sfoffo.com/protocols-and-services/oracle-tns.md) - [POP3](https://notes.sfoffo.com/protocols-and-services/pop3.md) - [RDP](https://notes.sfoffo.com/protocols-and-services/rdp.md) - [SMB](https://notes.sfoffo.com/protocols-and-services/smb.md) - [SMTP](https://notes.sfoffo.com/protocols-and-services/smtp.md) - [SNMP](https://notes.sfoffo.com/protocols-and-services/snmp.md) - [Utilities, Scripts and Payloads](https://notes.sfoffo.com/utilities-scripts-and-payloads.md) - [Shells and Payloads](https://notes.sfoffo.com/utilities-scripts-and-payloads/shells-and-payloads.md) - [Metasploit Framework](https://notes.sfoffo.com/utilities-scripts-and-payloads/metasploit-framework.md) - [File Transfers](https://notes.sfoffo.com/utilities-scripts-and-payloads/file-transfers.md) - [Pivoting, Tunneling, Port Forwarding](https://notes.sfoffo.com/utilities-scripts-and-payloads/pivoting-tunneling-port-forwarding.md) - [Password Attacks](https://notes.sfoffo.com/utilities-scripts-and-payloads/password-attacks.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on a page URL with the `ask` query parameter: ``` GET https://notes.sfoffo.com/readme.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.